allow URL not to be signed
prepare for release v1.5.1
fix User methods. Add Shared::login_user!